When can you send marketing emails and texts?

What it is

The rule applies to individual subscribers, including sole traders and some partnerships. Emails to corporate subscribers, such as a company address, do not need consent, but you must identify yourself and give a valid address for opting out, and a named employee can still object under the UK GDPR.

When you can send

• The individual has given specific consent to your marketing by that channel. PECR reg 22(2)
• Soft opt-in: details obtained in the course of a sale or negotiation, marketing your own similar products or services, with an opt-out offered at collection and in every message. PECR reg 22(3)
• Charity soft opt-in: a charity marketing for its charitable purposes to people who expressed interest or support, with an opt-out offered at collection and in every message. PECR reg 22, as amended by DUAA s.114
• To corporate subscribers, with your identity and an opt-out address. PECR regs 22 and 23

When you cannot

• Bought-in lists, unless each person consented specifically to messages from you.
• Anyone who has opted out, whatever the original basis. PECR reg 22(3)(c)
• Disguising or concealing your identity, or omitting a valid opt-out address. PECR reg 23

Who is responsible

The sender and any organisation that instigates the message, such as a brand using an affiliate.

What it involves

1. Record the consent or the soft opt-in facts.
2. Offer an opt-out at collection and in every message.
3. Keep and screen against a suppression list.
4. Identify yourself in every message.

If it goes wrong

Regulatory

The regulator can issue an enforcement notice and, since 2026-02-05, a penalty of up to £17.5 million or 4% of annual worldwide turnover (PECR as amended by DUAA s.115). Directors and officers can be fined personally where a marketing breach resulted from their conduct.

Criminal

No offence.

Civil

Anyone who suffers damage because of a breach of PECR can claim compensation from the person responsible (PECR reg 30).